mahesh chawla nrr/dorl/lpl3 office o8-f14: phone 301-415 … · attachments: audit plan for juno...

1

NRR-DMPSPEm Resource

From: Chawla, MaheshSent: Thursday, April 12, 2018 12:07 PMTo: Catron, Steve; Kilby, Gary; Schultz, Eric; Davis, J.MichaelCc: Manthei, Scott; Murrell, Bob; [email protected]; Probst, Jim; Locke,

KimSubject: Audit at NextEra Headquarters, Juno Beach, Florida - April 24, 2018 through April 26,

2018 - 50.69 LARs for Duane Arnold Energy Center (DAEC), and Point Beach Nuclear Plant (PBNP), Units 1 and 2 - EPIDs L-2017-LLA-0283/0284

Attachments: Audit Plan for Juno Beach Audit .docx; DAEC Audit Questions.docx; PNPB Audit Questions.docx

Dear Mr. Catron, By letter dated August 31, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession Number ML17243A469), NextEra Energy Duane Arnold, LLC (NextEra DAEC) submitted a license amendment request (LAR) to adopt 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors at Duane Arnold Energy Center (DAEC). . By letter dated August 31, 2017 (ADAMS Accession Number ML17243A201), as supplemented by letter dated October 26, 2017 (ADAMS Accession Number ML17299A012), NextEra Energy Point Beach (NextEra PBNP) submitted a LAR to adopt 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors at Point Beach Nuclear Plant (PBNP), Units 1 and 2. The NRC staff has reviewed the information provided in these LARs and determined that a site audit is required in order in order to get a better understanding of these applications; in order to complete its review. A site audit is scheduled at the NextEra Headquarters at the Juno Beach Facility, from April 24, 2018 through April 26, 2018. Attached here are the following documents.

1. Audit Plan 2. Duane Arnold Audit Questions 3. Point Beach Audit Questions Please arrange a clarification call as described in the audit plan. Also, please verify that the information in the attached documents does not contain any proprietary information. Please contact me if you have any further questions. Thanks Mac Mahesh Chawla NRR/DORL/LPL3 Office O8-F14: Phone 301-415-8371

Hearing Identifier: NRR_DMPS Email Number: 304 Mail Envelope Properties (SN6PR09MB26056821BBA7CEA2D4D2825AF1BC0) Subject: Audit at NextEra Headquarters, Juno Beach, Florida - April 24, 2018 through April 26, 2018 - 50.69 LARs for Duane Arnold Energy Center (DAEC), and Point Beach Nuclear Plant (PBNP), Units 1 and 2 - EPIDs L-2017-LLA-0283/0284 Sent Date: 4/12/2018 12:07:21 PM Received Date: 4/12/2018 12:07:00 PM From: Chawla, Mahesh Created By: [email protected] Recipients: "Manthei, Scott" <[email protected]> Tracking Status: None "Murrell, Bob" <[email protected]> Tracking Status: None "[email protected]" <[email protected]> Tracking Status: None "Probst, Jim" <[email protected]> Tracking Status: None "Locke, Kim" <[email protected]> Tracking Status: None "Catron, Steve" <[email protected]> Tracking Status: None "Kilby, Gary" <[email protected]> Tracking Status: None "Schultz, Eric" <[email protected]> Tracking Status: None "Davis, J.Michael" <[email protected]> Tracking Status: None Post Office: SN6PR09MB2605.namprd09.prod.outlook.com Files Size Date & Time MESSAGE 1607 4/12/2018 12:07:00 PM Audit Plan for Juno Beach Audit .docx 36808 DAEC Audit Questions.docx 50716 PNPB Audit Questions.docx 65066 Options Priority: Standard Return Notification: No Reply Requested: No Sensitivity: Normal Expiration Date: Recipients Received:

- 1 -

NEXTERA ENERGY -DUANE ARNOLD ENERGY CENTER AND POINT BEACH NUCLEAR PLANT, UNITS 1 AND 2

REGULATORY AUDIT IN SUPPORT OF THE LICENSE AMENDMENT APPLICATIONS TO ADOPT 10 CFR 50.69, "RISK-INFORMED CATEGORIZATION AND TREATMENT OF

STRUCTURES, SYSTEMS, AND COMPONENTS FOR NUCLEAR POWER PLANTS" (CAC NOS. MG0199, MG0196, MG0197)

(EPIDS L-2017-LLA-0283 and L-2017-LLA-0284)

1.0 BACKGROUND

By letters dated August 31, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession Nos. ML17243A469 and ML17243A201) NextEra Energy submitted license amendment requests for Duane Arnold Energy Center (DAEC) and Point Beach Nuclear Plant, Unit Nos. 1 and 2 to adopt Title 10 of the Code of Federal Regulations (10 CFR) 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components (SSCs) for Nuclear Power Plants”. This voluntary risk-informed alternative rule allows power reactor licensees and license applicants to apply a risk-informed categorization process to categorize SSCs based on their safety significance and the final rule was published in the Federal Register on November 22, 2004 (69 FR 68008). The U.S. Nuclear Regulatory Commission (NRC) staff issued Regulatory Guide (RG) 1.201, Revision 1, “Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance”, in May, 2006 (ADAMS Accession No. ML061090627).

The NRC staff’s review of the application has commenced in accordance with the Office of Nuclear Reactor Regulation’s (NRR) Office Instruction LIC-101, “License Amendment Review Procedures.” The NRC staff has determined that a regulatory audit of the licensee’s 10 CFR 50.69 applications should be conducted in accordance with the NRR Office Instruction LIC-111, “Regulatory Audits,” for the staff to gain a better understanding of the licensee’s proposed risk-informed categorization process.

A regulatory audit is a planned, license or regulation-related activity that includes the examination and evaluation of primarily non-docketed information. A regulatory audit is conducted with the intent to gain understanding, to verify information, and/or to identify information that will require docketing to support the basis of a licensing or regulatory decision. Performing a regulatory audit of the licensee’s information is expected to assist the staff in efficiently conducting its review or gain insights on the licensee’s processes or procedures. Information that the NRC staff relies upon to make the safety determination must be submitted on the docket. However, the NRC staff may review supporting information retained as records under 10 CFR 50.71 maintenance of records, making of reports and/or 10 CFR 54.37 additional records and record-keeping requirements, which although not required to be submitted as part of the licensing action, would help the staff better understand the licensee’s submitted information.

The objectives of this regulatory audit are to determine the technical adequacy of the application by:

• Verifying conformance of the categorization process with NRC-endorsed guidance and the licensee’s implementation of the endorsed categorization process.

• Validating Probabilistic Risk Assessment (PRA) quality is adequate for use in the

application.

- 2 -

• Confirming that non-PRA methods used for evaluating the risk from external hazards are

consistent with those allowed in NEI 00-04 and consider the current as-built, as-operated plant.

• Observing categorization process discussions.

• Identifying new information that is needed in order for staff to reach a licensing or

regulatory decision; discussing audit questions. 2.0 REGULATORY AUDIT BASIS

The basis of this audit is the NextEra Energy applications submitted August 31, 2017. NRC Inspection Manual, Inspection Procedure 37060, “10 CFR 50.69 Risk-Informed Categorization and Treatment of Structures, Systems, and Components Inspection” (ADAMS Accession No. ML111310693).

3.0 REGULATORY AUDIT SCOPE OR METHOD

The staff will verify conformance of categorization process with NRC-endorsed guidance. The staff will confirm that any non-PRA methods proposed for use in the categorization process are consistent with those allowed in NEI 00-04 “10 CFR 50.69 SSC Categorization Guideline,” (ADAMS Accession No. ML052900163), as endorsed, with clarifications in RG 1.201 Revision 1. The team plans to discuss audit questions and identify the need for additional information or clarification.

4.0 INFORMATION AND OTHER MATERIAL NECESSARY FOR THE AUDIT

The NRC audit team will require access to licensee personnel knowledgeable in all aspects of the 10 CFR 50.69 applications. At a minimum, a hardcopy and electronic copy of the following documentation should be available to the audit team on the first day of the audit. In addition presentations and specific discussion topics may be requested prior to the audit.

Documents

• Internal Events and Fire PRA documentation models should be available on computer with licensee support.

• Internal Events and Fire PRA peer review reports and fact and observation (F&O) closure reports.

• Documentation of changes to the PRA models with justification of upgrades/updates. • Peach Bottom 10 CFR 50.69 license application, as supplemented. • 10 CFR 50.69 draft procedures. • Documentation of draft categorization results.

Presentations • NRC observation of the categorization process plans

Discussions • Discussions of audit questions, related to:

• F&Os • PRA updates/upgrades, focused-scope peer reviews and F&O Closure • Discussion of the Integrated Decision-Making Panel (IDP)

- 3 -

5.0 TEAM ASSIGNMENTS

The audit will be conducted by NRC staff from the NRR, Division of Risk Assessment, PRA Licensing Branch-A (APLA) and NRC contractors from the Pacific Northwest National Laboratory (PNNL) in support of the technical audit team members. Staff knowledgeable in 10 CFR 50.69 and risk-Informed licensing reviews will comprise the audit team. Observers at the audit may include NRR technical reviewers and project managers.

The NRC Audit Team is listed in the table below. Leader will be Leslie Fields, and the NRC Technical Lead will be Mihaela Biro (PRA). The audit team leader will conduct daily briefings on the status of the review and coordinate audit activities while on site. The other tables below show (1) audit milestones and schedule, and (2) planned audit team composition and their assigned areas for review during the audit.

Duane Arnold/Point Beach 50.69 Audit Team

Name Organization Email address Title Office Phone

Stacey Rosenberg

NRC/DRA/BC [email protected] Branch Chief 301-415-2357

Leslie Fields NRC/DRA/Audit Lead

[email protected] Senior Project Manager

301-415-1186

Mahesh Chawla

NRC/DORL/PM [email protected] Project Manager

301-415-8371

Mihaela Biro NRC/DRA/ PRA 50.69

[email protected] Reliability and Risk Analyst

301-415-1243

Todd Hilsmeier

NRC/DRA/ PRA 50.69

[email protected] Reliability and Risk Analyst

301-415-6788

Stephen Dinsmore

NRC/DRA/ PRA 50.69

[email protected] Senior Reliability and Risk Analyst

301-415-8482

John Hanna NRC/RIII Observer

[email protected] Senior Reactor Analyst

630-829-9746

NRC Contractors

Garill Coles PNNL Contractor [email protected] Contractor 509-948-3605 ACRONYMS: (BC) Branch Chief, (DRA) Division of Risk Assessment, (DORL) Division of Reactor Licensing, (PRA) Probabilistic Risk Assessment, (PNNL) Pacific Northwest National Laboratory

Audit Milestones and Schedule Activity Time Frame Comments

Clarification Call 04/15/18 or later

Teleconference from NRC HQ to provide clarification of audit questions.

Onsite Audit Kick-Off Meeting

04/24/2018

NRC will present a brief team introduction and discuss the scope of the audit. The licensee should introduce team members and give logistics for the week.

- 4 -

Audit Milestones and Schedule

End of Day Summary Briefings

04/24/2018- 04/26/2018

Meet with licensee to provide a summary of any significant findings and requests for additional assistance.

Provide Rooms for Focused Topic Discussions

04/24/2018- 04/26/2018

Facilitate discussions between site and staff technical areas. Provide one or two breakout areas, if possible, for smaller discussions.

Onsite Audit Exit Meeting 04/26/2018 NRC staff will hold a brief exit meeting, with

licensee staff to conclude audit activities. Audit Summary (see 8.0)

90 days after exit To document the audit.

Regulatory Audit Plan Review Areas and Assignments

Lead Support 1 Categorization Process Team Team 2 PRA Technical Adequacy NRC PNNL 2.a Peer Reviews NRC PNNL 2.b Facts and Observations NRC PNNL 2.c PRA updates/upgrades NRC PNNL 3 External Hazards NRC PNNL 4 Integrated Decision-making Panel NRC PNNL 5 Documentation, Configuration Control, Quality NRC Team

6.0 LOGISTICS

This regulatory audit will begin on or about April 15, 2018, with a logistics/clarification call to ensure that you are able to prepare for the on-site portion of the audit which will commence on April 24, 2018, and will last approximately 3 days. The dates in the milestone chart are subject to change based on mutual agreement between the licensee and the NRC staff. An entrance meeting for the on-site portion of the audit will be held on the first day at 9:00 AM and an exit meeting will be held on the final day at 4:00 PM (earlier or later) based on a mutually agreed upon time. The NRC audit team leader will provide daily progress briefings to licensee personnel on the first and second day of the audit.

The audit will take place at a location agreed upon by the licensee and NRC audit leader where (1) the necessary reference material and (2) appropriate NextEra Energy staff will be available to support the review. Visitor access should be available for the entire audit team. We recommend that security paperwork and processing be handled prior to the first day of the audit, if possible.

7.0 SPECIAL REQUESTS

The regulatory audit team will requests the following arrangements to support the regulatory audit:

• Two computers with internet access and printing capability in the NRC room, access to

the site portal, and wired or wireless guest internet access for all team members.

• One main conference room with one additional private area for conference calling capability should be made available. The main NRC conference room should be set up for six to eight NRC staff and contractors.

• Access to licensee personnel knowledgeable of the categorization process, plant design,

operation and the plant PRA. In addition, licensee staff who participated in preparing the

- 5 -

LAR submittal should be available for discussion. 8.0 DELIVERABLES

A regulatory audit summary will be issued within approximately 90 business days after the completion of the audit. The summary will use the guidance of NRR Office Instruction LIC-111 for content. Audit questions will likely be sent prior to the audit. If additional information is required to be submitted to support the NRC review of the license amendment requests, the NRC staff will issue request for additional information. The audit summary will be placed in ADAMS.

-1-

AUDIT QUESTIONS

APPLICATION TO ADOPT 10 CFR 50.69 RISK-INFORMED CATEGORIZATION OF

STRUCTURES, SYSTEMS, AND COMPONENTS

NEXTERA ENERGY DUANE ARNOLD, LLC

DUANE ARNOLD ENERGY CENTER

DOCKET NO. 50-331

By letter dated August 31, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession Number ML17243A469), NextEra Energy Duane Arnold, LLC (NextEra) submitted a license amendment request (LAR) to adopt 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors at Duane Arnold Energy Center (DAEC). To complete its review, the NRC staff has the following questions it would like to discuss with the licensee during the audit. Question 01 - Internal Events and Internal Flooding PRA Peer Reviews LAR Section 3.3 states that the internal events model “was subject to a self-assessment and a peer review” in December 2007 and a focused peer review in March 2011. As stated in the NRC Safety Evaluation for Amendment Number 286 regarding transition to a risk-informed, performance-based fire protection program (RI/PB FPP) in accordance with 10 CFR 50.48(c), dated September 10, 2013 (ADAMS Accession No. ML13210A449), the 2007 peer review was performed against Regulatory Guide (RG) 1.200, Revision 1, “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,” (ADAMS Accession Number ML070240001), and the 2011 peer review was performed against RG 1.200, Revision 2, (ADAMS Accession Number ML090410014). The LAR for transition to a RI/PB FPP in accordance with 10 CFR 50.48(c), dated August 5, 2011 (ADAMS Accession No. ML11221A280), stated that the scope of the 2011 peer review focused on the supporting requirements (SR) associated with upgrades, updates, or previous Facts and Observations (F&Os). In a letter dated February 12, 2013 (ADAMS Accession Number ML13046A031), in support of its transition to a RI/PB FPP in accordance with 10 CFR 50.48(c), the licensee responded to RAI 65, and provided the results of the gap assessment conducted against RG 1.200 Revision 2 for the SRs not within the scope of the 2011 focused-scope peer review.

a. Describe how a “self-assessment and a peer review” is conducted, including the reference

documents used. Confirm and describe whether the internal flooding PRA was in scope of the 2007 and 2011 peer reviews, or otherwise provide the peer review history of the internal flooding PRA.

b. Provide an overview of all changes in the internal events and internal flooding PRA since the

last full scope peer review in 2007, which were not subject to the 2011 focused scope peer review, and justify whether any of these changes fit the definition of a PRA upgrade.

c. For each upgrade identified in item a. above, either provide the results of the focused-scope

peer review(s) performed on these upgrades and the disposition of any findings for the application.

-2-

Question 02 – F&O Closure Process LAR Section 3.3 states that closed findings were reviewed and closed using the process documented in Appendix X to Nuclear Energy Institute (NEI) 05-04, NEI-07-12, and NEI 12-13, “Close-out of Facts and Observations” as accepted by NRC in the staff memorandum dated May 3, 2017 (ADAMS Accession No. ML17079A427). NRC staff observed this F&O closure review in July 2017 (ADAMS Accession No. ML17356A055). Provide the following information to confirm that the July 2017 F&O closure review was performed consistent with the NRC accepted process, as documented in the NRC letter dated May 3, 2017 from Joe Giitter and Mary Jane Ross-Lee to Greg Krueger, NEI (ADAMS Accession No. ML17079A427). a. Clarify whether a focused-scope peer review was performed concurrently with the F&O

closure process. If so, provide the following:

i. Summary of the scope of the peer review.

ii. Detailed descriptions of any new findings generated from the peer review and their disposition for the application.

b. Confirm that the closure review team was provided with a written assessment and

justification of whether the resolution of each F&O, within the scope of the independent assessment, constitutes a PRA upgrade or maintenance update, as defined in American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) RA-Sa-2009, “Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,” as endorsed by RG 1.200 Revision 2, “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,” (ADAMS Accession Number ML090410014). If the written assessment and justification for the determination of each F&O was not performed and reviewed by the F&O closure review team, discuss how this aspect of the F&O closure process was met consistent with the staff’s acceptance as discussed in the May 3, 2017 letter.

c. Appendix X, (ADAMS Accession No. ML17086A451), Section X.1.3 includes five criteria for selecting members of the closure review team:

Describe how the selection of members for the July 2017 independent assessment met the five criteria.

d. Explain how closure of the F&Os was assessed to ensure that the capabilities of the PRA

elements, or portions of the PRA within the elements, associated with the closed F&Os now meet capability category II (CC-II) for all the applicable SRs of ASME/ANS RA-Sa-2009 as endorsed by RG 1.200 Revision 2.

e. Discuss whether the F&O closure review scope included all finding-level F&Os, including

those finding-level F&Os that are associated with “Met” SRs. If not, identify and provide detailed descriptions for any F&Os that were excluded from the F&O closure review scope, and their disposition for the application.

-3-

Question 03 – Fire PRA (FPRA) F&Os Attachment 3 of the LAR, “Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items,” provide F&Os findings that are still open or only partially resolved after the F&O closure review. For a number of F&O dispositions there is insufficient information for the NRC staff to conclude that the F&O is sufficiently resolved or has no impact on the application.

a. For F&O 1-1 related to SR ES-A4 the independent assessment (IA) team found that the PRA model did not include a model for multiple spurious operations (MSOs) causing diversion of residual heat removal (RHR) system flow into the primary containment. The disposition states that “given the relatively high significance of the RHR system, inclusion of this additional failure mode for RHR is needed, is unlikely to affect categorization of components in the risk-informed 50.69 application.” It also states that “prior to implementation either this finding will be closed or a sensitivity study case will be performed”.

i. Provide justification, such as via a sensitivity study, why this F&O has no impact on the 10 CFR 50.69 categorization results, or

ii. Propose a mechanism that ensures F&O 1-1 will be resolved in accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

b. For F&O 2-13 related to SR FQ-A3 the IA team found that “a systematic review of potential

recovery actions was not provided.” The disposition to this F&O states that recovery actions to restore offsite power and other internal event functions are either not credited or are given limited credit only in the fire PRA. It further states that “[p]rior to implementation, either this finding will be closed or a sensitivity study case will be performed to determine the impact on the [Core Damage Frequency] CDF and [Large Early Release Frequency] LERF results for those categorizations that could be adversely affected by this finding."


ii. Propose a mechanism that ensures F&O 2-13 will be resolved in accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

c. F&O 3-7 related to SR FSS-G2 identified deficiencies in failure probability of fire barriers in

the multi-compartment analysis (MCA). The acceptability evaluation states that “only a maximum of 1 penetration is ever listed in any barrier,” further questioning the failure probability for those barriers with multiple penetrations. The disposition to this F&O states that “since MCA scenarios contribute less that 1 percent of total CDF, this F&O is unlikely to affect categorization of components”. The disposition however also states that “[p]rior to

-4-

implementation, either this finding will be closed or a sensitivity study case will be performed to determine the impact on the CDF and LERF results for those categorizations that could be adversely affected by this finding."

i. Explain and justify how the failure probabilities of those fire barriers with multiple

penetrations are calculated, or

ii. Justify why this F&O has no impact on the 10 CFR 50.69 categorization, or

iii. Propose a mechanism that ensures fire F&O 3-7 will be resolved in accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

d. F&O 4-7 related to SR PRM-B9 states that the logic under gate HPCI-MSL-FLD appears to

be incorrect, because in the developed model both a High Pressure Coolant Injection (HPCI) valve failure and Level 8 Failure appeared to be required, and even if a Level 8 failure occurs, the valve failure can result in overfeed continuing. In a letter dated April 23, 2012 (ADAMS Accession Number ML12117A052), in support of its LAR to adopt a RI/PB FPP in accordance with 10 CFR 50.48(c), the licensee responded to RAI PRA 34 and stated that the model has been corrected. However, the NRC staff notes that the IA team found that the model logic was not corrected to remove a Level 8 Failure. i. Explain and justify the current model logic and clarify whether the model corrections

necessary to address this F&O are completed, or ii. Justify why this F&O has no impact on the 10 CFR 50.69 categorization, or

iii. Propose a mechanism that ensures that F&O 4-7 will be resolved in accordance with

an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

e. In resolution to F&O 4-12 related to SR PRM-B14 the licensee stated that a detailed fire

LERF model review has been completed, and that no changes from internal events LERF were identified. The IA team found recovery actions that appear should not be credited in the FPRA model related to injection recovery before Reactor Pressure Vessel (RPV) melt, RHR recovery, and alternating current (AC) power recovery. i. Provide justification for these credited recovery actions, or

ii. Propose a mechanism that ensures that F&O 4-12 will be resolved in accordance

with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

-5-

f. F&O 4-17 related to SR PRM-B9 found that the FPRA does not model systems required

for initiation and actuation and identified one example where the fail to close logic for the Main Steam Isolation Valves (MSIVs) did not include associated instrumentation, controls or operator actions. The IA team found that although the MSIV example has been addressed by modeling operator action to close the MSIVs, the broader finding concerning modeling of initiation and actuation systems, was not addressed. In disposition to this F&O, the licensee recognized that “additional review is needed for final disposition of this F&O, and stated that “the potential for this issue to affect categorization of components under the risk-informed 50.69 application is low.”


ii. Propose a mechanism that ensures that F&O 4-17 will be resolved in accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

g. In the resolution to F&O 4-21 related to SR FSS-A6 the licensee stated that the Main

Control Room (MCR) abandonment analysis was updated using a Conditional Core Damage Probability (CCDP) for non-abandonment based on functional failures and MSOs. The licensee further stated that the Alternate Shutdown Capability (ASC) CCDP is based on ASC functional failures and MSO probability. However the IA team found that no documentation was provided for the CCDP for the MCR non-abandonment scenarios, the MCR abandonment scenarios were not reflected in the PRA model and only one MCR scenario had MSO considerations. The licensee states that “it is not anticipated this activity will require significant changes to the model inputs” and “the potential for this issue to affect categorization of components ... is low”.


ii. Propose a mechanism that ensures fire F&O 4-21 will be resolved in accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

h. During the review of F&O 1-4 related to SR IGN-A9 and F&O 5-9 related to IGN-A8, the IA

team found discrepancies between documented fire ignition frequencies values and those used in the model for several physical analysis units (PAU). In disposition of this F&O the licensee stated that “prior to implementation of the 50.69 categorization this finding will be closed or a sensitivity study case will be performed”.


-6-

ii. Propose a mechanism that ensures F&Os 1-4 and 5-9 will be resolved in accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

i. F&O 4-35 related to SR FSS-D7 found that a review of the fire detection and suppression

systems has not been performed. It further found that “there is no evidence of development of a suppression system monitoring system nor implementation of monitoring reliability attributes.” The F&O disposition states that “a minor update of the Fire Scenario Report to describe DAEC’s NFPA 805 monitoring program is needed to close this item”.

i. Explain and justify how a review of the fire detection and suppression systems has

been performed and explain how any outcomes from this review have been addressed, or

ii. Justify why this F&O has no impact on the 10 CFR 50.69 categorization process, or

iii. Propose a mechanism that ensures that F&O 4-35 will be resolved in accordance


j. F&O 4-40 related to SR CF-A1 found that the requirement to analyze significant MSOs

using plant specific circuit analysis was not performed. The IA team found that the licensee only performed a limited analysis to identify potential conservatism with air operated valves (AOVs) and motor operated valves (MOVs), but the general F&O concern to analyze all MSOs was not addressed. The disposition states that “the potential for affecting categorization of components … is very low”.



k. F&O 4-41 related to PRM-B10 found that recovery of feedwater is credited for scenarios

where Main Feedwater (MFW) is not credited. The IA team found that the issue has not been resolved and that the fire PRA model needed corrections. The resolution to this F&O states that “recovery of feedwater is not credited when either train is damaged by fire,” but does not explain how this F&O has been resolved. Explain how the recovery of feedwater is credited in the FPRA, and how the F&O has been resolved or provide justification that the resolution has no impact on the 50.69 categorization process.

-7-

l. In its review of F&O 5-2 related to FQ-E1 and associated licensee’s resolution, the IA team found that the FPRA has not been reviewed for model and operational consistency with regards to operator actions and multiple spurious shorts, as originally indicated in the F&O. The disposition states that “based on the substantial level of review already performed on model cutsets … inclusion of these additional items is not likely to affect categorization of components”.



m. For F&O 5-5 related to SR FQ-E1, the IA team found that no evidence that a review of the

bottom cutsets for both CDF and LERF has been conducted. Confirm and describe how the review of the bottom cutsets has been performed.

n. For F&O 5-22 related to SR CS-B1 the IA team found that SR CS-B1 is not met due to an

incomplete evaluation of overcurrent protection for common enclosure issues for 480V and 4kV breakers. The IA team identified the lack of consideration of whether a fire induced loss of control power to associated 4kV and 480 V breakers with subsequent fire induced short circuiting of the breaker’s power cables could result in unanalyzed breaker coordination concern and possible secondary fires. The disposition states that “prior to implementation of the 50.69 categorization this finding will be closed or a sensitivity study case will be performed”.

i. Provide justification, such as via a sensitivity study, why this F&O has no impact on

the 10 CFR 50.69 categorization results, or


o. F&O 5-30 related to SR HRA-A4 found that operator interviews were not conducted and

detailed review and talk-through were not performed for the important scenarios. The disposition to this F&O states that “although HRA failure rates could be adjusted […], fire scenarios are not likely to be restructured in a manner where key systems are added or removed.” It further states that “prior to implementation of the 50.69 categorization this finding will be closed or a sensitivity study case will be performed”, but did not disposition the F&O for the application.


-8-


p. F&O 6-2 related to SR PP-A1 found that the switchyard fire was excluded from the Global

Analysis Boundary without justification. The disposition states that “since the fire PRA is dominated by loss of offsite power accident scenarios, addition of new scenarios initiated by switchyard fire, if necessary, is unlikely to affect categorization of components under the risk-informed 50.69 application.” It further states that “prior to implementation of the 50.69 categorization this finding will be closed or a sensitivity study case will be performed”, but did not disposition the F&O for the application.

i. Provide justification, such as via a sensitivity study, why this F&O has no impact on

the 10 CFR 50.69 categorization results, or


Question 04 - Fire PRA updates/upgrades The LAR states that the FPRA model was subject to a peer review in November 2010. As discussed in the Safety Evaluation for Amendment Number 286 regarding transition to a RI/PB FPP in accordance with 10 CFR 50.48(c), dated September 10, 2013 (ADAMS Accession No. ML13210A449), the 2010 peer review was performed against RG 1.200 Revision 2.

a. Provide an overview of all FPRA changes since the 2010 peer review and justify whether

any of these changes fit the definition of a PRA upgrade. b. For each upgrade identified in item a. above, either provide the results of the focused-scope

peer review(s) performed on these upgrades and disposition of any findings, or provide a mechanism that ensures that a focused-scope peer review of the upgrade is performed and all resulting F&Os are closed through either a new peer review or an NRC accepted F&O closure process prior to implementing the 10 CFR 50.69 categorization process.

Question 05 – Items to be Complete Prior to Implementing 10 CFR 50.69 LAR Section 3.2.3 states that “An evaluation will be performed of the as-built, as-operated plant against the SMA [Seismic Margin Assessment] SSEL [Safe Shutdown Equipment List]. The evaluation will compare the as-built, as-operated plant to the plant configuration originally assessed by the SMA. Differences will be reviewed to identify any potential impacts to the equipment credited on the SSEL. Appropriate changes to the credited equipment will be identified and documented.”

-9-

Further, Attachment 3 of the LAR indicates a number of planned updates to the FPRA model after the 10 CFR 50.69 amendment has been issued and before implementation of the 10 CFR 50.69 program. a. Provide a list of each activity and PRA change, including any items from question 01

through 04 which will not be completed prior to issuing the amendment but must be completed prior to implementing the 10 CFR 50.69 categorization process and provide a method to ensure that all issues will be addressed and any associated changes will be made, that focused-scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard, and that any findings will be resolved prior to implementation of the 10 CFR 50.69 categorization process (for example, a license condition that all applicable items will be completed prior to categorization).

Question 06 – Key Assumptions and Sources of Uncertainty for Internal Events PRA LAR Section 3.2.7 states that the model assumptions and sources of uncertainty are evaluated and documented in Attachment 6. It concludes that no additional sensitivity analysis are required to address DAEC PRA model specific assumptions or sources of uncertainty. For several of the listed uncertainties, Attachment 6 states that those uncertainties are “retained as a candidate modeling uncertainty”, but does not appear to disposition them for the application. The following items are listed in the LAR as “candidate modeling uncertainty”:

i. Loss of Offsite Power (LOOP) frequency and fail to recover probabilities (LAR page 49);

ii. Feedwater (FW) / Condensate / Control Rod Drive (CRD) and alternate crossties injection capability after large catastrophic containment failure (LAR page 51);

iii. Heating Ventilation and Air Conditioning (HVAC) credit for the Electrical Switchgear rooms (LAR page 52);

iv. Credit for equipment operation (Low Pressure Coolant Injection (LPCI)/ Core Spray (CS) for loss of Net Positive Suction Head (NPSH) or loss of cooling, HPCI for loss of lube oil cooling, Control Room equipment) in environmental conditions that exceed the design basis envelope (LAR page 53);

v. Internal flooding initiating event frequencies (LAR page 54); and, vi. Interfacing System Loss of Coolant Accident (ISLOCA) frequency (LAR page 56).

For each “candidate modeling uncertainty” listed in the LAR, address the following: a. Justify why the described uncertainty has no impact on the 50.69 categorization process, or

b. Describe a sensitivity study to be performed during the 50.69 categorization process, in

accordance with the guidance in Section 5 of NEI 00-04, “10 CFR 50.69 SSC Categorization Guideline,” Revision 0, (ADAMS Accession Number ML052910035).

RAI 07 – Fire PRA Uncertainties The guidance in Section 5 of NEI 00-04 as endorsed by RG 1.201, Revision 1, "Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to Their Safety Significance," (ADAMS Accession Number ML061090627), indicates that identification of any applicable sensitivity studies to be used during the categorization process that are associated with the licensee's choice of specific models and assumptions, as discussed in RG 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on

-10-

Plant-Specific Changes to the Licensing Basis," (ADAMS Accession Number ML100910006), The LAR states that PRA model-specific assumptions and sources of uncertainty for this application are evaluated and documented in Attachment 6 to the LAR. However, LAR Attachment 6 appears to only address internal events PRA uncertainties. Further, when reviewing FPRA F&O 5-16 the IA Team found no evidence that the licensee conducted a specific review for any fire-related uncertainties for the FPRA. The disposition states that “inclusion of fire related uncertainties is not likely to affect categorization of components” but did not provide any supporting justification. Provide a discussion of the fire related uncertainties in the FPRA and identify if any of these uncertainties are key to the application and would require sensitivity studies to be conducted during the categorization process, consistent with the guidance in NEI 00-04, Section 5.2. RAI 08 – Overall Categorization Process LAR Section 3.1.1, “Overall Categorization Process,” has two different sets of bulleted elements and concludes with an additional list of ten elements. The elements discuss: training that will be provided, the different hazard models, and PRA model results. However, it is not clear to the NRC staff what the sequence of evaluations will be in the categorization process, what information will be developed and used, and what guidance on acceptable decisions by the Integrated Decision-Making Panel (IDP) will be followed during the categorization of each system.

a. Summarize, in the order they will be performed, the sequence of elements or steps that will be followed to categorize a respective system. A flow chart, such as that provided in the NEI presentation (ADAMS Accession Number ML17249A072) for the September 6, 2017, public meeting with NEI regarding 10 CFR 50.69 LARs (ADAMS Accession Number ML17265A020) may be provided instead of a description. The steps should include: i. The input from all PRA evaluations such as use of the results from the internal

events, internal flooding, seismic, and fire PRAs;

ii. The input from non-PRA approaches (other external events, and shutdown);

iii. The input from the responses to the seven qualitative questions in NEI 00-04, Section 9.2;

iv. The input from the defense-in-depth (DID) matrix;

v. The input from the passive categorization methodology.

b. Clarify the difference between “preliminary high safety significant (HSS)” and “assigned

HSS” and identify which inputs can, and which cannot, be changed from preliminary HSS to low safety significant (LSS) by the IDP. Confirm that the approach is consistent with the guidance in NEI 00-04, as endorsed by RG 1.201, Revision 1.

c. Clarify which steps of the process are performed at the function level and which steps are performed at the component level. Describe how the categorization of the component impacts the categorization of the function, and vice-versa. Describe any instances in which the final safety significance of the function would differ from the safety significance of

-11-

the component(s) that support the function, and confirm that the approach is consistent with the guidance in NEI 00-04 as endorsed by RG 1.201, Revision 1.

d. NEI 00-04, Section 7, states that “if any SSC is safety significant, from either the PRA-

based component safety significance assessment (Section 5) or the defense-in-depth assessment (Section 6), then the associated system function is preliminary safety significant.” Describe whether your categorization process is consistent with or differs from the guidance in NEI 00-04, Section 7, where functions supported by any HSS component(s) will be assigned as HSS. If your categorization process differs from the guidance in Section 7 of NEI 00-04 cited above where functions supported by any HSS component(s) will be assigned HSS, justify the approach.

e. The industry flow chart presented at the September 6, 2017 public meeting (ADAMS

Accession Number ML17249A072) shows that the passive categorization would be undertaken separately from the active categorization.

i. Explain how the results from the passive categorization will be integrated with the

overall categorization results.

ii. If the results from the passive categorization can be changed by the IDP, explain and justify the proposed approach.

f. NEI 00-04, Section 9.2.2, “Review of Safety Related Low Safety-Significant

Functions/SSCs,” states “in making their assessment, the IDP should consider the impact of loss of the function/SSC against the remaining capability to perform the basic safety functions.” This section also provides seven questions that should be considered for making the final determination of the safety-significance for each system function/SSC. However, it is unclear in the LAR how the IDP will collectively assess these seven specific questions. For example, is a function/SSC considered HSS when the answer to any one question is false (e.g., failure of the function/SSC will directly cause an initiating event or adversely affect the defense-in-depth remaining to perform the function). Explain how the IDP will collectively assess the seven specific questions to identify a function/SSC as LSS as opposed to HSS.

g. NEI 00-04, Section 7.1 states, “[d]ue to the overlap of functions and components, a significant number of components support multiple functions. In this case, the SSC or part thereof should be assigned the highest risk significance for any function that the SSC or part thereof supports.” Clarify at what point during the risk categorization process will assessment of the risk significance of SSCs that support multiple functions be identified to ensure they are assigned the highest risk significance given all SSCs that may overlap may not be categorized.

Question 09 – SSCs Categorization Based on Other External Hazards NEI 00-04 provides guidance on including external events in the categorization of each SSC to be categorized. Fire and seismic hazards are discussed in Sections 5.2 and 5.3, respectively. All other hazards are discussed in Section 5.4, “Assessment of Other External Hazards.” Figure 5-6 in Section 5.4 illustrates the process that begins with the SSC selected for categorization and then proceeds through the flow chart for each external hazard. According to this figure, if a component participates in a screened scenario, then in order for that component to be

-12-

considered candidate LSS, it has to be further shown that if the component was removed, the screened scenario would not become unscreened. The LAR states that “other hazards were screened from applicability to DAEC per a plant-specific evaluation in accordance with Generic Letter (GL) 88-20 and updated to use the criteria in ASME [American Society of Mechanical Engineers] PRA Standard RA-Sa-2009, Part 6.“ a. Attachment 4 of the LAR indicates that the extreme wind or tornado hazard is screened on

the basis that the high winds CDF is estimated to be less than 1E-6/year. This implies that there are certain mitigating SSCs that, if removed, could increase the CDF above 1E-6/year, and so, these SSCs would become HSS, per the guidance in Figure 5-6 of NEI 00-04.

i. Identify types of SSCs, if any, credited in the screening of high winds and tornado

hazards, including passive and/or active components.

ii. Explain and justify how the guidance in Figure 5-6 of NEI 00-04 will apply to the high winds and tornado hazard and whether this hazard will or will not be considered during the categorization process.

b. The LAR states that the external flooding hazards are screened based on criterion C1,

“Event damage potential is < events for which plant is designed.”

Explain and justify how the guidance in Figure 5-6 of NEI 00-04 will be applied to external flooding hazards and whether these hazards will or will not be considered during the categorization process.

Question 10 – Shutdown Risk LAR Section 3.2.5 states the DAEC categorization process will use the shutdown safety management plan described in NUMARC 91-06, “Guidelines for Industry Actions to Assess Shutdown Management” (ADAMS Accession No. ML14365A203), for categorization of safety significance related to low power shutdown conditions. However, the LAR does not cite the other criteria specified in NEI 00-04, Section 5.5, pertaining to low power shutdown events (i.e., includes defense-in-depth attributes and failures that would initiate a shutdown event). Clarify and provide a basis for how the categorization of SSCs will be performed for shutdown events and how it is consistent with the guidance in NEI 00-04, as endorsed by RG 1.201. RAI 11 – Passive Component Categorization LAR Section 3.1.2, “Passive Categorization Process,” states that passive components and the passive function of active components will be evaluated using the method for risk-informed repair/replacement activities consistent with the safety evaluation issued by the Office of Nuclear Reactor Regulation, “Request for Alternative ANO2-R&R-004, Revision 1, Request to Use Risk-informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, Third and Fourth 10-Year In-service Inspection Intervals,” for Arkansas Nuclear One, Unit 2, dated April 22, 2009 (ADAMS Accession No. ML090930246). The LAR further states that this methodology will be applied to determine the safety significance of Class 1 SSCs. The NRC staff notes that this methodology has been approved for Class 2 and Class 3 SSCs. Because Class 1 SSCs constitute principal fission product barriers as part of the reactor coolant

-13-

system or containment, the consequence of pressure boundary failure for Class 1 SSCs may be different than that for Class 2 and Class 3 SSCs. Therefore, the criteria in the ANO-2 methodology cannot automatically be generalized to Class 1 SSCs without further justification. The LAR does not justify how the ANO-2 methodology can be applied to Class 1 SSCs and how sufficient defense-in-depth and safety margins are maintained. An acceptable technical justification for Class 1 SSCs would have to address how the methodology is sufficiently robust to assess the safety significance of Class 1 SSCs, including, but not limited to: justification of the appropriateness of the numerical criteria for conditional core damage probability (CCDP) and conditional large early release probability (CLERP) used to assign ‘High’, ‘Medium’ and ‘Low’ safety significance to these loss of coolant initiating events; identification and justification of the adequacy of the additional qualitative considerations to assign ‘Medium’ safety significance (based on the CCDP and CLERP) to ‘High’ safety significance; justification for crediting operator actions for success and failure of pressure boundary; guidelines and justification for selecting the appropriate break size (e.g. double ended guillotine break or smaller break); and include supporting examples of types of Class 1 SSCs that would be assigned low safety significance. As mentioned in the meeting summary from the February 20, 2018 Risk-Informed Steering Committee (RISC) meeting (ADAMS Accession No. ML18072A301), NRC staff understands that the industry is planning to limit the scope of passive categorization to Class 2 and Class 3 SSCs, consistent with the pilot Vogtle license amendment (ADAMS Accession No. ML14237A034). Please provide the requested technical justification or confirm the intent to apply the ANO-2 passive categorization methodology only to Class 2 and Class 3 SSCs.

AUDIT QUESTIONS APPLICATION TO ADOPT 10 CFR 50.69 RISK-INFORMED CATEGORIZATION OF

STRUCTURES, SYSTEMS, AND COMPONENTS NEXTERA ENERGY

POINT BEACH NUCLEAR PLANT (PBNP) UNITS 1 AND 2 DOCKET NOS. 50-266 AND 50-301

By letter dated August 31, 2017 (Agencywide Documents Access and Management System (ADAMS) Accession Number ML17243A201), as supplemented by letter dated October 26, 2017 (ADAMS Accession Number ML17299A012), NextEra Energy Point Beach (NextEra) submitted a license amendment request (LAR) to adopt 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems, and Components for Nuclear Power Reactors. To complete its review, the NRC staff has the following questions it would like to discuss with the licensee during the audit.

Question 01 – Facts and Observations (F&O) Closure Process LAR Section 3.3 states that an F&O closure peer review was performed using the process documented in Appendix X to Nuclear Energy Institute (NEI) 05-04, NEI 07-12, and NEI 12-13, “Close-out of Facts and Observations” as accepted by the U.S. Nuclear Regulatory Commission (NRC) in the letter from Joseph Giitter and Mary Jane Ross-Lee, NRC to Greg Krueger, NEI, dated May 3, 2017 (ADAMS Accession Number ML17079A427). NRC staff provided observations of this F&O Closure on July 2017 (ADAMS Accession Number ML17356A055). Provide the following information to confirm that the July 2017 F&O closure review was performed consistent with the NRC accepted process, as discussed in the May 3, 2017 letter.

a. Clarify whether a focused-scope peer review was performed concurrently with the F&O closure process. If so, provide the following:

i. Summary of the scope of the peer review.

ii. Detailed descriptions of any new F&Os generated from the peer review and the

associated dispositions for the application.

b. Confirm that the closure review team was provided with a written assessment and justification of whether the resolution of each F&O, within the scope of the independent assessment, constitutes a probabilistic risk assessment (PRA) upgrade or maintenance update, as defined in American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) RA-Sa-2009, “Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications,” as qualified by Regulatory Guide (RG) 1.200, Revision 2, “An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities,” (ADAMS Accession Number ML090410014). If the written assessment and justification for the determination of each F&O was not performed and reviewed by the F&O closure review team, discuss how this aspect of the F&O closure process was met consistent with the staff’s acceptance as discussed in the May 3, 2017 letter.

- 2 -

c. Appendix X (ADAMS Accession Number ML17086A451), Section X.1.3 includes five criteria for selecting members of the closure review team.

Describe how the selection of members for the July 2017 independent assessment met the five criteria.

d. Explain how closure of the F&Os was assessed to ensure that the capabilities of the PRA elements, or portions of the PRA within the elements, associated with the closed F&Os now meet capability category (CC) II (CC-II) for SRs from ASME/ANS RA-Sa-2009, as endorsed, with clarifications and qualifications, by RG 1.200, Revision 2.

e. Discuss whether the F&O closure review scope included all finding-level F&Os, including those finding-level F&Os that are associated with “Met” SRs. If not, identify and provide detailed descriptions for any F&Os that were excluded from the F&O closure review scope, and their associated disposition for the application.

Question 02 – Open/Partially Open Findings in the Process of Being Resolved Attachment 3 of the LAR, “Disposition and Resolution of Open Peer Review Findings and Self-Assessment Open Items,” provides finding-level F&Os that are still open or only partially resolved after the F&O closure review. For a number of F&O dispositions there is insufficient information for NRC staff to conclude that the F&O is sufficiently resolved for this application. The NRC staff notes that F&O descriptions and their dispositions were previously provided to the NRC in the LAR to adopt for Technical Specification Task Force (TSTF)-425, “Relocate Surveillance Frequencies to Licensee Control – Risk Informed Technical Specifications Task Force (RITSTF) Initiative 5b” (ADAMS Accession Number ML14190A267). The NRC staff notes that modelling issues that can cause even small impacts to core damage frequency (CDF) and large early release frequency (LERF) (both increases and decreases) can potentially increase the risk importance values for certain system components above the threshold criteria for determining safety significance specified in Section 5 of NEI 00-04, “10 CFR 50.69 SSC Categorization Guideline,” Revision 0, (ADAMS Accession Number ML052910035). In light of these observations, address the following:

a. F&O IE-A1-01 regarding special initiating events:

The disposition to F&O IE-A1-01 presented in the TSTF-425 LAR indicates that a number of special initiators related to the 4160 volts alternating current (VAC) Vital Switchgear bus were not included in the internal events PRA (IEPRA) model because they were considered not significant, and estimated the CDF for sequences associated with these initiators as high as 1.9E-07/year. It is not clear to the NRC staff that excluding these sequences cannot increase the risk importance values for specific system components above the threshold criteria for determining safety significance as discussed in NEI 00-04, Section 5. Therefore:

i. Provide justification, that exclusion of scenarios associated with the cited 4160 VAC

Vital Switchgear bus related initiators has no impact on the 10 CFR 50.69 categorization results, or

ii. Propose a mechanism that ensures F&O IE-A1-01 will be resolved in accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to the implementation of the 10 CFR 50.69

- 3 -

categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

b. F&O AS-B6-01 and F&O SY-A21-01 regarding excluded electrical alignment

The dispositions to F&Os AS-B6-01 and SY-A21-01 presented in the TSTF-425 LAR stated that although Emergency Diesel Generator (EDG) load management is a potential failure mode for EDGs, it is not modeled in the PRA. The TSTF-425 LAR further provided an estimate of the low likelihood that the EDG load management would be needed. The estimated low likelihood is based on the assumption that the events used in the estimate are independent. The NRC staff notes that loss of coolant accident (LOCA) initiators can induce loss of offsite power (LOOP) events and LOOP initiators can induce LOCAs (i.e., the need for safety injection (SI)) making these events dependent. Additionally, NRC staff notes that modelling exclusions that cause just small increases to CDF/LERF can impact the categorization of specific structures, systems, and components (SSCs). Therefore:

i. Provide justification, such as via a sensitivity study, that the excluded scenarios

involving failure of EDG load management has no impact on the 10 CFR 50.69 categorization results. Include consideration of LOCA induced LOOP events and LOOP induced LOCA events, or

ii. Propose a mechanism that ensures F&Os AS-B6-01 and SY-A21-01 will be resolved

in accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&Os will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

c. F&O AS-B7-01 regarding inadequate treatment of time-phased modelling

The disposition to F&O AS-B7-01 presented in the TSTF-425 LAR states that recovery of LOOP events is only credited for station blackout (SBO) scenarios and the direct current (DC) batteries are conservatively assumed to fail at time zero. Conservative modeling in the PRA can skew the plant’s risk profile and impact the SSCs risk importance values determined as part of 10 CFR 50.69 categorization. Therefore: i. Provide justification, such as via a sensitivity study, that the conservative modelling

associated with LOOP recovery and not crediting DC batteries has no impact on the 10 CFR 50.69 categorization results, or

ii. Propose a mechanism that ensures F&O AS-B7-01 will be resolved in accordance


d. F&O HR-D1-01 regarding detailed assessments for significant human failure events

(HFEs)

- 4 -

The disposition to F&O HR-D1-01 in LAR Attachment 3 states that no further changes are required. Also, based on the disposition presented in the TSTF-425 LAR, the F&O appeared resolved. Yet, the LAR associated with the adoption of 10 CFR 50.69 states regarding the disposition of this F&O, “[p]rior to implementation, either this finding will be closed or a sensitivity study case will be performed to determine the impact on the CDF and LERF results for those categorizations that could be adversely affected by this finding.” Therefore:

i. Provide the reason why this F&O could not be closed by the F&O closure review in July 2017.

ii. Justify why this F&O has no impact on the 10 CFR 50.69 categorization results or

propose a mechanism that ensures F&O HR-D1-01 will be resolved in accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

e. F&O IFQU-A6-01 regarding HFEs for internal flooding scenarios

The description for F&O IFQU-A6-01 states, “HFEs from internal events are ‘adjusted’ with inadequate basis for those adjustments.” The disposition for this F&O presented in the TSTF-425 LAR states that “stress multipliers” from Table 20-16 of NUREG/CR-1278, “Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications, Final Report,” 1983 (ADAMS Accession Number ML071210299), which are referred to as “stress modifiers” in NUREG/CR-1278, were used to account for the stress associated with an internal flooding event. However, Table 20-16 of the cited NUREG lists modifiers to be applied to human error probabilities (HEPs) for different stress levels and they are not specific to internal flooding. In light of these observations:

i. Explain whether these “stress modifiers” are being applied to the internal events

HEPs or to HEPs developed from a human reliability analysis (HRA) specific to the internal flooding PRA. If these modifiers are being used in an HRA specific to the internal flooding PRA, then address the following:

1. Clarify what HRA method is being used (e.g., Cause-Based Decision Tree

Method (CBDTM) or Technique for Human Error Rate Prediction (THERP)) and how the modifiers are applied within the method.

2. Justify that the HRA method used is adequate and the values used from NUREG/CR-1278 (that do not seem to relate to internal flooding stress) are appropriate.

ii. Propose a mechanism that ensures F&O IFQU-A6-01 will be resolved in accordance

with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be

- 5 -

resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

iii. Alternatively to item ii above, provide justification, such as via a sensitivity study, that

the HRA approach used for the internal flooding PRA has no impact on 10 CFR 50.69 categorization results.

f. F&O FSS-B1-01 regarding control room abandonment

The description for F&O FSS-B1-01 explains that Main Control Room (MCR) abandonment due to loss of control caused by fires in non-MCR locations is possible, but MCR abandonment is not credited for these scenarios. The disposition states, “[t]he current methodology is judged to be conservative.” Conservative modeling in the PRA can skew the plant’s risk profile and impact the SSCs’ risk importance values determined as part of 10 CFR 50.69 categorization, particularly the importance values determined for SSCs assumed failed. In light of these observations:

i. Provide justification, such as via a sensitivity study, that the conservative modelling

associated with not crediting MCR abandonment due to loss of control caused by fires in non-MCR locations has no impact on the 10 CFR 50.69 categorization results, or

ii. Propose a mechanism that ensures F&O FSS-B1-01 will be resolved in accordance


g. F&O PRM-B2-01 regarding the impact of internal events findings on the fire PRA

The description for F&O PRM-B2-01 states that resolution of internal events findings could impact fire PRA evaluations. The disposition to this F&O states, “[a]s of the time of this submittal, the only remaining open internal events peer review findings identified…are AS-B6-01 and SY-A21-01.” NRC staff notes that AS-B6-01 and SY-A21-01 are the subject of Question 02.b above. Therefore:

i. Provide justification, such as via a sensitivity study, that not updating the fire PRA

to include the resolution of internal events F&Os AS-B6-01 and SY-A21-01 has no impact on the 10 CFR 50.59 categorization results, or

ii. Propose a mechanism that ensures F&O PRM-B2-01 will be resolved in

accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

h. F&O HRA-B2-01 regarding credit for graphically distinct procedural steps

- 6 -

The description for F&O HRA-B2-01 found that credit for graphically distinct factors is taken for all HRA events, as opposed to taking credit for graphically distinct procedural steps that stand out from the other steps. The disposition for this F&O states, “[o]nly about 10% of the HEPs that credited graphically distinct procedure steps would be increased by more than a factor of 2.” The disposition concludes “[b]ased on this review, the impact on the model from this finding is judged minimal.” NRC staff notes that modelling issues that can cause even small increases to CDF and LERF can potentially increase the risk importance values for specific system components above the threshold criteria for determining safety significance specified in NEI 00-04, Section 5. Therefore:

i. Provide justification, such as via a sensitivity study, that not performing the cited

correction to the HRA has no impact on the 10 CFR 50.69 categorization results, or

ii. Propose a mechanism that ensures F&O HRA-B2-01 will be resolved in accordance with an NRC-accepted process (e.g., full-scope peer review, focused-scope peer review, or F&O closure review) prior to implementation of the 10 CFR 50.69 categorization process. This mechanism should also specify how the F&O will be resolved in the PRA (e.g., provide an explicit description or a reference to the appropriate section of the LAR).

i. F&O FQ-A1-01 regarding FRANX and CAFTA discrepancies

The description for F&O FQ-A1-01 states, “some basic events that have been mapped to scenarios, components, or cables are not found in the CAFTA model.” The associated disposition states, “information in the mapping table should be reviewed to eliminate the extraneous information and eliminate the discrepancies.” The disposition for this F&O presented in the PBNP LAR for transition to the National Fire Protection Association (NFPA) Standard 805 (ADAMS Accession Number ML13182A353) indicates that this review has been performed which identified six failure events that were excluded from the PRA associated with the MCR. The PBNP NFPA 805 LAR for this disposition also states that a sensitivity study was conducted which determined that the exclusion of these basic events have a negligible impact on fire risk. In light of these observations:

i. Justify that modeling the six excluded basic events associated with failures in the

MCR cited in the PBNP NFPA 805 LAR disposition for this F&O has no impact on the 50.69 categorization results, or

ii. Propose a mechanism that ensures F&O FQ-A1-01 will be resolved in accordance


Question 03 – PRA maintenance versus PRA upgrade Section 3.2 of the LAR states “[a]ll the PRA models described below have been peer reviewed and there are no PRA upgrades that have not been peer reviewed.” Justify that any PRA update performed to resolve any F&O discussed in Questions 01, 02 or 07, does not constitute a “PRA upgrade” as defined in ASME/ANS RA-Sa-2009, Section 1-5.4, as qualified by RG

- 7 -

1.200, Revision 2. If an upgrade has been identified, provide the summary and results of the focused-scope peer review performed on the upgrade, including all finding-level F&Os and a disposition for each F&O as it pertains to the impact on the 10 CFR 50.69 application.

Question 04 – Overall Categorization Process LAR Section 3.1.1, “Overall Categorization Process,” has two different sets of bulleted elements and concludes with an additional list of ten elements. The elements discuss: training that will be provided, the different hazard models, and PRA model results. However, it is not clear to the NRC staff what the sequence of evaluations will be in the categorization process, what information will be developed and used, and what guidance on acceptable decisions by the Integrated Decision-Making Panel (IDP) will be followed during the categorization of each system.

a. Summarize, in the order they will be performed, the sequence of elements or steps that will be followed to categorize a respective system. A flow chart, such as that provided in the NEI presentation (ADAMS Accession Number ML17249A072) for the September 6, 2017, public meeting with NEI regarding 10 CFR 50.69 LARs (ADAMS Accession Number ML17265A020) may be provided instead of a description. The steps should include:

i. The input from all PRA evaluations such as use of the results from the internal events, internal flooding, seismic, and fire PRAs;

ii. The input from non-PRA approaches (other external events, and shutdown);

iii. The input from the responses to the seven qualitative questions in NEI 00-04,

Section 9.2;

iv. The input from the defense-in-depth (DID) matrix;

v. The input from the passive categorization methodology.

b. Clarify the difference between “preliminary high safety significant (HSS)” and “assigned HSS” and identify which inputs can, and which cannot, be changed from preliminary HSS to low safety significant (LSS) by the IDP. Confirm that the approach is consistent with the guidance in NEI 00-04, as endorsed by RG 1.201, Revision 1, “Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance,” (ADAMS Accession Number ML061090627).

c. Clarify which steps of the process are performed at the function level and which steps are performed at the component level. Describe how the categorization of the component impacts the categorization of the function, and vice-versa. Describe any instances in which the final safety significance of the function would differ from the safety significance of the component(s) that support the function, and confirm that the approach is consistent with the guidance in NEI 00-04 as endorsed by RG 1.201, Revision 1.

d. NEI 00-04, Section 7, states that “if any SSC is safety significant, from either the PRA-based component safety significance assessment (Section 5) or the defense-in-depth assessment (Section 6), then the associated system function is preliminary safety significant.” Describe whether your categorization process is consistent with or differs from

- 8 -

the guidance in NEI 00-04, Section 7, where functions supported by any HSS component(s) will be assigned as HSS. If your categorization process differs from the guidance in Section 7 of NEI 00-04 cited above where functions supported by any HSS component(s) will be assigned HSS, justify the approach.

e. The industry flow chart presented at the September 6, 2017 public meeting shows that the passive categorization would be undertaken separately from the active categorization.

i. Explain how the results from the passive categorization will be integrated with the overall categorization results.

ii. If the results from the passive categorization can be changed by the IDP, explain and

justify the proposed approach.

f. NEI 00-04, Section 9.2.2, “Review of Safety Related Low Safety-Significant Functions/SSCs,” states “in making their assessment, the IDP should consider the impact of loss of the function/SSC against the remaining capability to perform the basic safety functions.” This section also provides seven questions that should be considered for making the final determination of the safety-significance for each system function/SSC. However, it is unclear in the LAR how the IDP will collectively assess these seven specific questions. For example, is a function/SSC considered HSS when the answer to any one question is false (e.g., failure of the function/SSC will directly cause an initiating event or adversely affect the defense-in-depth remaining to perform the function). Explain how the IDP will collectively assess the seven specific questions to identify a function/SSC as LSS as opposed to HSS.

g. NEI 00-04, Section 7.1 states, “[d]ue to the overlap of functions and components, a significant number of components support multiple functions. In this case, the SSC or part thereof should be assigned the highest risk significance for any function that the SSC or part thereof supports.” Clarify at what point during the categorization process will assessment of the risk significance of SSCs that support multiple functions be identified to ensure they are assigned the highest risk significance given all SSCs that may overlap may not be categorized.

Question 05 – SSCs Categorization based on Other External Hazards NEI 00-04 provides guidance on including external events in the categorization of each SSC to be categorized. The process begins with the SSC selected for categorization, as illustrated in NEI 00-04, Section 5.4, Figure 5-6 and proceeds through the flow logic for each external hazard. According to Figure 5-6, if a component participates in a screened scenario, then in order for that component to be considered candidate LSS, it has to be further shown that if the component was removed, the screened scenario would not become unscreened. The LAR does not address this aspect of the guidance, but appears to indicate “other external hazards” (i.e., besides seismic events) are screened from consideration in the categorization process.

a. Identify the external hazards that will be evaluated according to the flow chart in NEI 00-04, Section 5.4, Figure 5-6.

b. Identify the external hazards for which all credited SSCs will be considered HSS.

- 9 -

c. Describe and justify any additional method(s) different from (a) or (b) above that will be used to evaluate individual SSCs against external hazards and identify the hazards that will be evaluated with these methods.

d. Confirm that all external hazards not included in the categorization process (a), (b), or (c) above, will be considered insignificant for every SSC and, therefore, will not be considered during the categorization process.

e. Extreme winds and tornado hazards

Attachment 4 of the LAR, as supplemented, indicates that the extreme wind or tornado hazard is screened on the basis that the high winds CDF is estimated to be less than 1E-6/year. This implies that there are certain mitigating SSCs that, if removed, could increase the CDF above 1E-6/year, and so, these SSCs would become HSS, per the guidance in Figure 5-6 of NEI 00-04. Explain and justify how the guidance in Figure 5-6 of NEI 00-04 will apply to the high winds hazard and whether this hazard will or will not be considered during the categorization process.

f. External Flooding Hazard

Attachment 4 of the LAR indicates that external flooding hazards are screened from consideration in the 10 CFR 50.69 process. The LAR states that the external flooding hazard was screened because events associated with this hazard are bounded by the current licensing basis or in the case of a local intense precipitation (LIP) event there is “an acceptable method of assuring safe shutdown.” The LAR states that for LIP “implementing the FLEX strategy provides an acceptable method of assuring safe shutdown.” Section 5.4 of NEI 00-04 states that “after identifying the design basis and severe accident functions of the component, the external hazard analysis is reviewed to determine if the component is credited as part of the safe shutdown paths evaluated. If the component is credited, it is considered safety-significant.” Further, Figure 5-6 of NEI 00-04 shows that if a component participates in a screened scenario, then in order for that component to be considered candidate LSS, the licensee has to show that if the component was removed, the screened scenario would not become unscreened.

i. Identify all SSCs that are credited in the screening of the LIP that should be designated safety significant per the guidance in Section 5.4 of NEI 00-04, including passive and/or active components. It should be noted, according to the LAR, it appears that FLEX strategy is relied upon for LIP mitigation. Additionally NRC notes that in a letter from NextEra to the NRC dated June 22, 2017 regarding a focused evaluation for LIP events (ADAMS Accession Number ML17173A082) that PBNP has committed to providing flood protection for the “B” train emergency diesel generator exhaust stacks.

ii. Identify any SSCs that are credited in the screening of all other external flooding

mechanisms (other than LIP), including passive and/or active components.

iii. Explain and justify how the guidance in Figure 5-6 of NEI 00-04 will be applied to external flooding. Specifically, Figure 5-6 shows that if a component participates in a screened scenario, then in order for that component to be considered candidate

- 10 -

LSS, the licensee has to show that if the component was removed, the screened scenario would not become unscreened.

Question 06 – Shutdown Risk LAR Section 3.2.5, “Low Power & Shutdown,” states the categorization process will use the shutdown safety management plan described in NUMARC 91-06, “Guidelines for Industry Actions to Assess Shutdown Management,” December 1991, (ADAMS Accession Number ML14365A203) for categorization of safety significance related to low power and shutdown conditions. However, the LAR does not cite the other criteria specified in NEI 00-04, Section 5.5, “Shutdown Safety Assessment,” pertaining to low power shutdown events (i.e., DID attributes and failures that would initiate a shutdown event). Clarify and provide the basis for how the categorization of SSCs will be performed for low power and shutdown events, and how it is consistent with the guidance in NEI 00-04 as endorsed by RG 1.201, Revision 1. Question 07 – Key Assumptions and Uncertainties that could Impact the Application LAR Section 3.2.7, “PRA Uncertainty Evaluations,” explains that PRA model assumptions and sources of uncertainty have been identified for this application using guidance from NUREG-1855, “Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making,” (ADAMS Accession Number ML090970525). LAR Section 3.2.7 indicates that no additional sensitivity analyses are required to address PBNP PRA model specific assumptions or sources of uncertainty beyond what is already required by Sections 5 and 8 of NEI 00-04. The dispositions presented in Attachment 6 of the LAR for key assumptions and modeling uncertainties appear to fall into one of three categories: (1) the assumption is conservative, (2) the impact is small (negligible), or (3) the assumption realistically models the plant design. NRC staff notes that modelling issues that represent small impacts to CDF and LERF (both increases and decreases) could potentially increase the risk importance values for certain system components above the threshold criteria for determining safety significance specified in NEI 00-04, Section 5. In light of these observations, address the following:

a. Operator action to control Auxiliary Feedwater (AFW) flow late in the accident sequence Attachment 6 (page 51) of the LAR explains that a sensitivity analysis performed evaluating the impact of not controlling AFW flow for the full PRA mission time shows that exclusion of operator action to control AFW flow late in the accident sequence has a “small” impact. It is not clear to the NRC staff how the sensitivity analysis demonstrates that the exclusion of this operator action has no impact on the categorization of SSCs under 10 CFR 50.69; therefore:

i. Justify that the exclusion of this operator failure to control the AFW flow late in the

accident sequence has no impact on the 10 CFR 50.69 categorization results, or

ii. Propose a mechanism that ensures that the operator failure to control the AFW flow late in the accident sequence will be incorporated into the PRA prior to implementation of the 10 CFR 50.69 categorization process.

b. Operator action to close containment isolation valves

Attachment 6 (page 51) of the LAR explains that the PRA assumes for all LOCAs that there is sufficient time for an operator to close containment isolation valves following failure of the

- 11 -

valves to automatically close. The LAR explains that the results of a sensitivity on this operator action demonstrates that the impact of crediting this action made a “negligible change to LERF.” It is not completely clear to the NRC staff what “negligible change” means quantitatively and notes that just small increases to LERF can impact the categorization of specific SSCs. Therefore:

i. Justify that the operator action to close containment isolation valves following failure

of the valves to automatically close has been demonstrated to be plausible and feasible and justify how SR HR-H2 from ASME/ANS RA-Sa-2009 is met for this operator action, or

ii. Justify that credit for the operator action to close containment valves has no impact on the 10 CFR 50.69 categorization results, or

iii. Propose a mechanism that ensures the credit for operator action to close

containment isolation valves is removed from the PRA prior to implementation of the 10 CFR 50.69 categorization.

c. Expansion joint failures not in the PRA model

Attachment 6 (page 51) of the LAR explains that failures of expansion joints are not modelled in the fire protection system for the fire PRA. The LAR explains that the results of a sensitivity analysis on this failure mode demonstrates that the impact of crediting this action has a “negligible impact on the results.” It is not clear to NRC staff what “negligible impact on the results” means quantitatively and notes that just small increases to CDF/LERF can impact the categorization of specific SSCs. Therefore:

i. Justify that the exclusion of the cited failure mode has no impact on the 10 CFR

50.69 categorization results, or

ii. Propose a mechanism that ensures that the expansion joint failures will be incorporated into the fire PRA prior to implementation of the 10 CFR 50.69 categorization process.

Question 08 – Passive Categorization Process LAR Section 3.1.2, “Passive Categorization Process,” states that passive components and the passive function of active components will be evaluated using the method for risk-informed repair/replacement activities consistent with the safety evaluation issued by the Office of Nuclear Reactor Regulation, “Request for Alternative ANO2-R&R-004, Revision 1, Request to Use Risk-informed Safety Classification and Treatment for Repair/Replacement Activities in Class 2 and 3 Moderate and High Energy Systems, Third and Fourth 10-Year In-service Inspection Intervals,” for Arkansas Nuclear One, Unit 2, dated April 22, 2009 (ADAMS Accession Number ML090930246). The LAR further states that this methodology will be applied to determine the safety significance of Class 1 SSCs. The NRC staff notes that this methodology has been approved for Class 2 and Class 3 SSCs. Because Class 1 SSCs constitute principal fission product barriers as part of the reactor coolant system or containment, the consequence of pressure boundary failure for Class 1 SSCs may be different than that for Class 2 and Class 3 SSCs. Therefore, the criteria in the ANO-2 methodology cannot automatically be generalized to Class 1 SSCs without further justification.

- 12 -

The LAR does not justify how the ANO-2 methodology can be applied to Class 1 SSCs and how sufficient defense-in-depth and safety margins are maintained. An acceptable technical justification for Class 1 SSCs would have to address how the methodology is sufficiently robust to assess the safety significance of Class 1 SSCs, including, but not limited to: justification of the appropriateness of the numerical criteria for conditional core damage probability (CCDP) and conditional large early release probability (CLERP) used to assign ‘High’, ‘Medium’ and ‘Low’ safety significance to these loss of coolant initiating events; identification and justification of the adequacy of the additional qualitative considerations to assign ‘Medium’ safety significance (based on the CCDP and CLERP) to ‘High’ safety significance; justification for crediting operator actions for success and failure of pressure boundary; guidelines and justification for selecting the appropriate break size (e.g. double ended guillotine break or smaller break); and include supporting examples of types of Class 1 SSCs that would be assigned low safety significance. As mentioned in the meeting summary from the February 20, 2018 Risk-Informed Steering Committee (RISC) meeting (ADAMS Accession Number ML18072A301), NRC staff understands that the industry is planning to limit the scope of passive categorization to Class 2 and Class 3 SSCs, consistent with the pilot Vogtle license amendment (ADAMS Accession Number ML14237A034). Please provide the requested technical justification or confirm the intent to apply the ANO-2 passive categorization methodology only to Class 2 and Class 3 SSCs.